IIS 7.5 和混合模式身份验证（单点登录）
有人设法实现这一目标吗？
应用程序应该像这样工作：
- 应用程序管理员可以添加 AD 用户
- 应用程序管理员可以定义不是来自 AD 的用户
- 如果用户是从 AD 添加的并尝试从同一 AD 访问应用程序 - 应用程序应该自动让他登录（单点登录）。
- 如果用户不是来自 AD，或者未添加为应用程序用户 - 将显示应用程序登录表单
顺便提一下，我设法在 IIS6 上实现了这一点。到目前为止，我已经阅读了几种涉及 IIS 7 和 7.5 的技术，但似乎没有一个在部署到生产服务器上时真正起作用。
到目前为止，我有 2 个独立的网络应用程序。一个 Web 应用程序配置了表单身份验证 - 这是主要的。其他配置为windows身份验证。
所以想法是，用户尝试访问主应用程序，这个应用程序将他重定向到另一个尝试提取他的域用户名（NTLM）的应用程序，并将他重定向回主应用程序。主应用程序尝试以 AD 用户身份登录，如果失败，则会显示登录信息。如果 AD 用户被添加为应用程序用户（使用应用程序的单独管理模块），则应自动对其进行身份验证，这意味着不应显示 IIS 登录提示。
这两个应用程序运行在同一个应用程序池中。而且它们都处于集成管道模式。
如果我在我的开发 win7 IIS 上设置它，那么这是有效的，但是当我在带有 IIS 7.5 的 win 2008 服务器上部署应用程序时，它不起作用。我不断收到 IIS 登录提示。如果我在 IIS 登录提示中输入凭据，它最终会将我登录到应用程序中。
有没有人有类似的问题并希望解决它？
Has anyone managed to achieve this?
Application should work like this:
- App admin can add AD users
- App admin can define users not from AD
- If user is added from AD and trying to access to application from same AD - application should log him in automatically (single sign on).
- If user is not from AD, or not added as application user - application login form is displayed
Just to mention, I managed to achieve this on IIS6. I have read several techniques so far with IIS 7 and 7.5 involved, but it seems none of them really works when deployed on production server.
So far I have 2 separate web applications. One web application is configured with forms authentication - this one is main. Other is configured as windows authentication.
So idea is, user tries to acces to main application, this one redirects him to the other application which tries to extract his domain username (NTLM), and redirects him back to main application. Main application tries to log him in as AD user, if this fails forms login is displayed. If AD user is added as application user (using separate admin module of application), he should be authenticated automatically, meaning no IIS login prompt should be displayed.
These two applications are running in same application pool. Also they are both in integrated pipeline mode.
This works if I set it up on my development win7 IIS, but when I deploy application on win 2008 server with IIS 7.5 - it's not working. I keep getting IIS login prompt. If I enter my credentials to IIS login prompt it will eventually log me into application.
Has anyone has similar issue and hopefully solved it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
请使用您提供的信息更新问题。
据我了解，这两个应用程序位于同一个应用程序池中，我相信您需要将它们分成两个应用程序池。
Please update the question with the info you have provided.
As I understand, these two applications are in the same app pool and I believe you need to separate them into two app pools.
进度更新 - 此身份验证现在按预期工作（我不必拆分应用程序池）。问题是，在访问应用程序的计算机上，应用程序服务器必须注册为本地内联网。为了 IE 向服务器发送凭据，这是必须的。
Progress update - this authentication works now as expected (I didn't have to split app pools). Problem was that on machine accessing application, app server hasto be registered as Local intranet. This is a must in order to IE sends credentials to server.